Bump cryptography to 50.0.0 in pyproject.toml (Mend HIGH CVE-2026-69247)

[odosk]

⚠️ This PR was created by an AI assistant (Claude). Please review all changes carefully before merging.

Summary

Bumps cryptography past the PKCS#7 Bleichenbacher-oracle fix flagged by Mend as HIGH CVE-2026-69247 (GHSA-g6cj-pr64-35w5). master resolves cryptography 49.0.0 (vulnerable range >=44.0.0, <50.0.0); this PR moves the floor and lock to the first patched release, 50.0.0.

Changed Files

pyproject.toml — dependency floor + in-file pin sweep:

• cryptography: >=48.0.1 → >=50.0.0 (CVE-2026-69247)
• build: ==1.0.3 → ==1.5.0 (within-major sweep)
• ipykernel: ==6.30.1 → ==6.31.0 (within-major sweep, docs + notebooks extras)

uv.lock — regenerated via uv lock --upgrade; cryptography resolves to 50.0.0 and all locked dependencies move to the latest compatible releases.

CVEs Addressed

Verified against the GitHub Advisory Database:

Package	CVE(s)	Severity	Fix version reached
cryptography	CVE-2026-69247	high	49.0.0 → 50.0.0

Implementation Notes

• Scoped to the flagged manifest (pyproject.toml) plus its lockfile per core-repo policy — no repo-wide sweep.
• Within the flagged file, setuptools==83.0.0, twine==5.1.1, and toml==0.10.2 are already at the latest release within their majors and are unchanged.
• uv lock --upgrade carries side-effect upgrades of locked transitive dependencies (e.g. transformers 5.8.0 → 5.14.1, tqdm 4.67.3 → 4.70.0, vespacli 8.709.19 → 8.730.36); all are ordinary latest-compatible resolutions within the existing constraints.
• Overlaps with Renovate PR chore(deps): update dependency cryptography to v50 [security] - autoclosed #1334 (cryptography-only); this PR additionally refreshes the lock and sweeps in-file pins per the dependency-fix policy.

Verification

• uv lock --upgrade resolves cleanly
• grep -A1 'name = "cryptography"' uv.lock → version = "50.0.0" (master: 49.0.0)
• GHSA-g6cj-pr64-35w5: vulnerable >=44.0.0, <50.0.0, first patched 50.0.0
• Full CI runs on this PR

Jira: VESPANG-3772